Jul 2026· Journal of integrated science and technology· Vol 14, pp. 1620· 0 citations
TL;DR
The proposed LLM-based framework offers a promising approach for improving phishing detection and strengthening modern cybersecurity defenses and suggests that transformer-based models can effectively identify deceptive domain structures, abnormal URL patterns, and obfuscation techniques.
Abstract
Phishing attacks remain a major cybersecurity threat, causing financial loss, data breaches, and reputational damage to individuals and organizations. Conventional detection methods, such as rule-based filters and blacklist-based systems, often fail to identify newly generated or highly obfuscated phishing URLs. Recent advances in artificial intelligence, particularly large language models (LLMs), provide new opportunities to detect complex structural and contextual patterns in malicious web addresses. This study evaluates the effectiveness of transformer-based LLMs for phishing URL detection by comparing LLaMA-3 and GEMMA-7B with traditional machine learning models, including Support Vector Machines, Random Forest, and XGBoost. The models were fine-tuned and tested on a publicly available dataset containing 247,950 labeled URLs, each described by 42 structural and lexical features. To support transformer-based classification, structured URL attributes were converted into textual representations, enabling the models to exploit contextual embeddings. Experimental results showed that LLMs outperformed conventional machine learning baselines. GEMMA-7B achieved the best performance, with an accuracy of approximately 94.8%, followed by LLaMA-3 at 94%. These findings suggest that transformer-based models can effectively identify deceptive domain structures, abnormal URL patterns, and obfuscation techniques. Overall, the proposed LLM-based framework offers a promising approach for improving phishing detection and strengthening modern cybersecurity defenses.
Efficiency makes the proposed approach exceptionally suitable for real-time detection in resource-constrained environments, such as mobile applications or browser extensions, providing an accessible and proactive layer of defense for end-users.
Phishing remains one of the most prevalent and financially damaging cyberattack vectors, with attackers routinely
disguising malicious links through typosquatting, homograph substitution, brand impersonation, and abuse of free top-level
domains. Existing defenses are largely reactive — blocklist services cannot flag a newly registered phishing domain until it has
already been reported, while enterprise secure-web gateways are priced for organizations rather than individual users. In this
paper, we propose RakshNet–PhishGuard, a client-first, multi-layer URL threat detection system that classifies a submitted URL
as Safe, Suspicious, or Phishing without depending on a live threat-intelligence database. Twenty-five lexical and structural
features are extracted from each URL and evaluated by two cooperating layers: a deterministic heuristic engine that checks
twelve categorical red-flag rules, and a machine-learning ensemble of six classifiers — Logistic Regression, Naive Bayes,
Decision Tree, Random Forest, Support Vector Machine, and Gradient Boosted Trees (XGBoost) — trained on a stratified 168-
URL sample drawn from the Hannousse and Yahiouche phishing-URL benchmark. A large-language-model layer (Google
Gemini, invoked through a serverless cloud function) converts the combined verdict into a plain-language explanation for nontechnical users, and a community-reporting module lets users flag suspicious URLs for analyst review. Under 5-fold stratified
cross-validation, Logistic Regression achieved the best overall performance (79.17% accuracy, 0.861 AUC), followed closely by
the Support Vector Machine (76.19% accuracy, 0.859 AUC); a Random Forest feature-importance analysis further shows that
the categorical indicators the heuristic layer specifically targets carry essentially zero learned weight in the trained models,
confirming the two layers cover complementary failure modes. The project's documented test plan, covering single and bulk
scanning, role-based access, and the AI-service fallback path, produced its expected result in all eight scenarios, with heuristic
analysis completing in under 50 ms per URL. This paper additionally positions the system against nine related works spanning
feature-engineered ML, deep representation learning, and large-language-model-assisted detection, and reports the system's
functional, non-functional, and hardware/software requirements in full. The complete system is implemented as a React 18 and
TypeScript single-page application in which every trained model runs entirely client-side, requiring no backend inference server.
Palla Srinivas, Pravitha R Prasad· International Journal for Re...· 0 citations
The purpose of the article is to design and experimentally evaluate a lightweight URL pre-filtering model that can be integrated into an email gateway, browser extension or SOC monitoring module and to review current approaches to phishing mitigation.
D. Abrosimov, D. Balagura, A.M. Yevheniev et al.· Terra security· 0 citations
This work reframes cross-model phishing detection from a problem of model incompatibility to one of practical calibration, and provides two deployable solutions, threshold recalibration on a small target slice and aggregated-pool training, along with a publicly released multi-LLM corpus.
Rommel Gutierrez, W. Villegas-Ch., Jaime Govea· Frontiers in Big Data· 0 citations
In the technology era, Phishing has continued to be a great challenge within the cybersecurity and web security landscape. This involves exploiting human trust on any online services and subtle technical flaws. This is to gather credentials, financial data, and sensitive information across diverse online platforms and various users. Traditional defenses like static blacklists, signature-based filters and simple detection rules are limited by slow update cycles and an inability to capture subtle syntactic and behavioral cues. To address these shortcomings, we propose a hybrid detection framework that fuses classical supervised machine-learning classifiers (e.g., Logistic Regression, SVM, Random Forest, XGBoost) with sequence-aware deep learning (LSTM) to jointly model lexical, structural, syntactic, and behavioral features extracted from URLs and webpage metadata. This combined approach leverages the interpretability and stability of ML models alongside the pattern-learning strength of LSTMs to detect both known and zero-day phishing attempts, produce calibrated confidence scores and deliver comprehensive reports via a real-time web interface resulting in a robust, transparent, and operationally useful solution for strengthening web security.
M. Yaswanth, Pathan Basheer Khan, Dhulipalla Naga Harish et al.· 2026 7th International Confe...· 0 citations
Phishing attacks based on Uniform Resource Locator (URL) links are one of the most significant cyber threats capable of exploiting user negligence at government institutions, including the Meteorology, Climatology, and Geophysics Agency (BMKG). This study aims to design and build a machine learning-based phishing URL detection system using the Random Forest algorithm integrated with the WhatsApp Bot messaging application. URL features were extracted from lexical aspects, government-specific domain knowledge, and BMKG domain typosquatting indicators. The model was trained using a dataset of 12,744 URLs consisting of 6,372 legitimate URLs and 6,372 phishing URLs with an 80:20 data split. Statistical evaluation results on the testing set (2,549 URLs) show that the Random Forest model achieves an accuracy of 98.16%, precision of 98.73%, recall of 97.57%, and F1-score of 98.14%. Functionality testing through Black Box Testing on 20 test URLs (10 legitimate and 10 phishing) produced a 100% success rate with an average response time of less than 10 seconds per URL. This integration is proven to provide a practical, responsive, and precise early detection solution for BMKG employees.
Iqbal Fariansyah Ridwan, E. Trihadi, Andri Setiyaji· Internet of Things and Artif...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
